Analysis
- max time kernel
150s - max time network
209s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
30/11/2022, 23:45
Static task
static1
Behavioral task
behavioral1
Sample
Reporte_Estado_De_Pago.pdf_Certificado-0000100000050089468x.msi
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
Reporte_Estado_De_Pago.pdf_Certificado-0000100000050089468x.msi
Resource
win10v2004-20221111-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target Reporte_Estado_De_Pago.pdf_Certificado-0000100000050089468x.msi
- Size 6.4MB
- Sample221130-3rrvwaag21
- SHA256 df2f7dee20fb4b16fd8dbd026583c9669c60d772c0cb9b22bc0ef51bba45e69d
- MD5 be2d38ae522e0850e300ff1747b18bf0
- SHA1 bbbd704ee895d7092c4cf413721b2723036cc409
- SHA512 5ec2469ef7d5e82f7c70212d3083a3196df7eefa749e610fa9c871ca4d83945f251a4733fe5e16c3efe83d3b755b20357a9a0efc1b04edc78fc804c95ddb3df8
- SSDEEP 98304:3YWtMEAdaWRuqjDsd+pr4FoFASIejlFGXXyYgx2jhFmFP1HTk9hxhyNHArShYJp:ZAaWktdlydTiiHx2dgFPa9hxhiAX
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 5 IoCs
flow pid Process 77 3848 MsiExec.exe 79 3848 MsiExec.exe 80 3848 MsiExec.exe 85 3848 MsiExec.exe 91 3848 MsiExec.exe - Loads dropped DLL 6 IoCs
pid Process 3848 MsiExec.exe 3848 MsiExec.exe 3848 MsiExec.exe 3848 MsiExec.exe 3848 MsiExec.exe 3848 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 76 ipinfo.io 77 ipinfo.io - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIF1A5.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e57eaae.msi msiexec.exe File opened for modification C:\Windows\Installer\e57eaae.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIEBF6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF108.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFBD9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFC76.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIF214.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{3CFDCF08-2FE9-41C2-BBBD-6F4A8EAD06A7} msiexec.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4380 msiexec.exe 4380 msiexec.exe 3848 MsiExec.exe 3848 MsiExec.exe 3848 MsiExec.exe 3848 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 2632 msiexec.exe Token: SeIncreaseQuotaPrivilege 2632 msiexec.exe Token: SeSecurityPrivilege 4380 msiexec.exe Token: SeCreateTokenPrivilege 2632 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2632 msiexec.exe Token: SeLockMemoryPrivilege 2632 msiexec.exe Token: SeIncreaseQuotaPrivilege 2632 msiexec.exe Token: SeMachineAccountPrivilege 2632 msiexec.exe Token: SeTcbPrivilege 2632 msiexec.exe Token: SeSecurityPrivilege 2632 msiexec.exe Token: SeTakeOwnershipPrivilege 2632 msiexec.exe Token: SeLoadDriverPrivilege 2632 msiexec.exe Token: SeSystemProfilePrivilege 2632 msiexec.exe Token: SeSystemtimePrivilege 2632 msiexec.exe Token: SeProfSingleProcessPrivilege 2632 msiexec.exe Token: SeIncBasePriorityPrivilege 2632 msiexec.exe Token: SeCreatePagefilePrivilege 2632 msiexec.exe Token: SeCreatePermanentPrivilege 2632 msiexec.exe Token: SeBackupPrivilege 2632 msiexec.exe Token: SeRestorePrivilege 2632 msiexec.exe Token: SeShutdownPrivilege 2632 msiexec.exe Token: SeDebugPrivilege 2632 msiexec.exe Token: SeAuditPrivilege 2632 msiexec.exe Token: SeSystemEnvironmentPrivilege 2632 msiexec.exe Token: SeChangeNotifyPrivilege 2632 msiexec.exe Token: SeRemoteShutdownPrivilege 2632 msiexec.exe Token: SeUndockPrivilege 2632 msiexec.exe Token: SeSyncAgentPrivilege 2632 msiexec.exe Token: SeEnableDelegationPrivilege 2632 msiexec.exe Token: SeManageVolumePrivilege 2632 msiexec.exe Token: SeImpersonatePrivilege 2632 msiexec.exe Token: SeCreateGlobalPrivilege 2632 msiexec.exe Token: SeRestorePrivilege 4380 msiexec.exe Token: SeTakeOwnershipPrivilege 4380 msiexec.exe Token: SeRestorePrivilege 4380 msiexec.exe Token: SeTakeOwnershipPrivilege 4380 msiexec.exe Token: SeRestorePrivilege 4380 msiexec.exe Token: SeTakeOwnershipPrivilege 4380 msiexec.exe Token: SeRestorePrivilege 4380 msiexec.exe Token: SeTakeOwnershipPrivilege 4380 msiexec.exe Token: SeRestorePrivilege 4380 msiexec.exe Token: SeTakeOwnershipPrivilege 4380 msiexec.exe Token: SeRestorePrivilege 4380 msiexec.exe Token: SeTakeOwnershipPrivilege 4380 msiexec.exe Token: SeRestorePrivilege 4380 msiexec.exe Token: SeTakeOwnershipPrivilege 4380 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2632 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4380 wrote to memory of 3848 4380 msiexec.exe 87 PID 4380 wrote to memory of 3848 4380 msiexec.exe 87 PID 4380 wrote to memory of 3848 4380 msiexec.exe 87
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Reporte_Estado_De_Pago.pdf_Certificado-0000100000050089468x.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2632
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 60DBF6AF0595D1BDD1C94D9A03DD12B72⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3848
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSIEBF6.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIEBF6.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIF108.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIF108.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIF1A5.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIF1A5.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIF214.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIF214.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIFC76.tmp
- Size 5.8MB
- SHA256 8746baf5130285c866004589ff3cc1c1422b040f722231d2a3a5981a79588b0b
- MD5 b7c09601e4447f333948f7175303660d
- SHA1 8a4aaa7d6d6fc2cb061663733480365ebf3b7ab6
- SHA512 2b57904047c7f211c9b3404a551185a77cbbb3a81953f5b37f516aa3c7a44dcb71368818abf9031fae77d05ee2b358e43e0775a6e32fc811b71586070c6b321d
- SSDEEP 98304:yWRuqjDsd+pr4FoFASIejlFGXXyYgx2jhFmFP1HTk9hxhyNHArShYJ:yWktdlydTiiHx2dgFPa9hxhiAX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIFC76.tmp
- Size 5.8MB
- SHA256 8746baf5130285c866004589ff3cc1c1422b040f722231d2a3a5981a79588b0b
- MD5 b7c09601e4447f333948f7175303660d
- SHA1 8a4aaa7d6d6fc2cb061663733480365ebf3b7ab6
- SHA512 2b57904047c7f211c9b3404a551185a77cbbb3a81953f5b37f516aa3c7a44dcb71368818abf9031fae77d05ee2b358e43e0775a6e32fc811b71586070c6b321d
- SSDEEP 98304:yWRuqjDsd+pr4FoFASIejlFGXXyYgx2jhFmFP1HTk9hxhyNHArShYJ:yWktdlydTiiHx2dgFPa9hxhiAX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIFC76.tmp
- Size 5.8MB
- SHA256 8746baf5130285c866004589ff3cc1c1422b040f722231d2a3a5981a79588b0b
- MD5 b7c09601e4447f333948f7175303660d
- SHA1 8a4aaa7d6d6fc2cb061663733480365ebf3b7ab6
- SHA512 2b57904047c7f211c9b3404a551185a77cbbb3a81953f5b37f516aa3c7a44dcb71368818abf9031fae77d05ee2b358e43e0775a6e32fc811b71586070c6b321d
- SSDEEP 98304:yWRuqjDsd+pr4FoFASIejlFGXXyYgx2jhFmFP1HTk9hxhyNHArShYJ:yWktdlydTiiHx2dgFPa9hxhiAX
- MD5 SHA1 SHA512 SSDEEP